Repository navigation
Sandboxed bots can ask an unsandboxed bot to do what their sandbox refuses #279
Description
With #276, a sandboxed bot uses the agent CLI through its own socket, and the daemon caps what that socket can do. It can still submit a message to any bot, including an unsandboxed one such as a full-access lead. Nothing stops it from asking that bot to run, on its behalf, a command its own sandbox would refuse. The receiving bot sees an ordinary message.
This is a known gap, recorded so it isn't forgotten. It isn't planned for now.
Possible fix: mark messages that come from a sandboxed bot, for example through from/origin together with the sender's sandbox mode. The receiving bot and the approver's judge could then treat their content as untrusted, the way content fetched from outside is treated.
Activity
lydakis commentedon Oct 28, 2026
Known Linux gaps in the writable git folder from #285, logged here per the "good enough" stance:
.git/commondiron Linux. bubblewrap can't hold an empty placeholder there without stopping git, so the daemon removes anycommondira command made once that command ends. While the command is still running, a host-side git run in the same repository would follow it. macOS denies making the file outright..git/worktrees/<name>/commondirdoesn't stop the command renamingworktrees/<name>(orworktrees) and rebuilding it with its owncommondir. On macOS, Seatbelt already denies renaming those folders. The same applies on Linux to a linked worktree's git folder kept inside a root. A fix would bind each such folder onto itself so it becomes a mount point that can't be renamed.Generated by Claude Code
lydakis commentedon Oct 28, 2026
Adding to the first point above: Codex's security review on #285 confirmed that a detached (
detach=true) sandboxed command keeps the Linuxcommondirwindow open for as long as it runs. A Sonnygit worktree addon the host during that time would follow it. A real fix would keep the name unwritable in the host namespace, for example with a validcommondirfile pre-made and bound read-only, or with Landlock.Generated by Claude Code
lydakis commentedon Oct 28, 2026
One more writable-git-folder gap from #285's review. A sandboxed bot can replace
.git/logs/HEAD(or another reflog) with a symlink to a file outside its roots. Git opens reflogs withO_APPENDand withoutO_NOFOLLOW, so a later host-side commit appends a reflog line to that file with the person's permissions. Possible fixes are to refuse or clear symlinks underlogs/when building the policy, or to keeplogsread-only and let reflog writes ask.Generated by Claude Code
Sonny: sandbox leads and tasks by default (#285)